Identity-Based Lateral Movement

📅 September 29, 2026  |  🏷 General  |  Cyber Security, Information Security, Threat Management

A single compromised service account brought down a Fortune 500 retailer’s entire point-of-sale network in 2024 — not through malware, but through a sequence of legitimate authentication requests that no perimeter firewall could stop. The attacker never broke in. They walked in, wearing stolen credentials like a tailored suit. This is identity-based lateral movement, and it is quietly rewriting the playbook on enterprise compromise.

Unlike traditional lateral movement that relies on exploiting software vulnerabilities or deploying custom malware, identity-based lateral movement weaponizes trust itself — the trust your systems place in authenticated users, service accounts, and machine identities. Security teams that still orient their defenses around malware signatures and packet inspection are, in a very real sense, looking for the wrong thing entirely.

What Is Identity-Based Lateral Movement?

Lateral movement refers to the techniques adversaries use to progressively expand their access within a network after an initial foothold is established. Identity-based lateral movement specifically abuses legitimate authentication protocols, credentials, tokens, and trust relationships to traverse the environment — without triggering conventional endpoint or network-based detection controls.

The critical distinction is legitimacy. Where a traditional attack might deploy a reverse shell or exploit a buffer overflow, identity-based movement generates log entries that, in isolation, look completely normal. A domain admin authenticating to a file server. A service account querying Active Directory. A cloud workload assuming an IAM role. Each event is defensible on its own; only the sequence reveals the attack.

The Authentication Protocols Adversaries Love Most

Three protocols dominate identity-based lateral movement tradecraft:

• Kerberos: Pass-the-ticket (PtT) and Overpass-the-Hash attacks allow adversaries to forge or steal Kerberos tickets, impersonating any principal in an Active Directory environment without knowing the underlying password.
• NTLM: Pass-the-hash (PtH) attacks reuse captured NTLM hashes to authenticate to Windows services. Despite Microsoft’s longstanding guidance to disable NTLM, Mandiant’s 2025 M-Trends report noted NTLM relay attacks in 34% of investigated intrusions.
• OAuth 2.0 / OIDC: Token hijacking and OAuth consent phishing are increasingly weaponized in hybrid and cloud-native environments, granting persistent access to SaaS platforms and cloud control planes.

Service Accounts: The Silent Attack Surface

Service accounts represent one of the most exploited identity surfaces in enterprise environments. According to CrowdStrike’s 2026 Global Threat Report, service account credentials are involved in over 60% of identity-based lateral movement cases. These accounts are often over-privileged (granted domain admin “for convenience”), rarely audited, and configured with non-expiring passwords — a trifecta of security debt that adversaries have learned to exploit systematically.

How Attackers Chain Identity Abuses: The Kill Chain Reframed

Identity-based lateral movement rarely operates as a single technique. It functions as a chain — each link amplifying access until the adversary reaches their objective, whether that’s ransomware deployment, intellectual property exfiltration, or persistent presence for future operations.

Consider a representative attack chain observed in a 2025 financial sector intrusion analyzed by Microsoft’s Detection and Response Team (DART):

1. Initial Access: A phishing email delivers a credential harvesting page mimicking the corporate SSO portal. One developer’s credentials are captured.
2. Credential Escalation: The developer account has access to a CI/CD pipeline. The attacker extracts hardcoded service account credentials from a build script stored in the repository.
3. Privilege Discovery: The service account has read access to Azure AD and reveals all group memberships, including dormant admin accounts.
4. Token Abuse: Using a forged SAML assertion (a “Golden SAML” attack), the adversary authenticates as a Global Administrator to the Microsoft 365 tenant.
5. Persistence and Exfiltration: A new OAuth application is registered with Mail.Read and Files.ReadWrite.All permissions, establishing persistent access that survives password resets.

The entire chain took 11 days from initial compromise to data exfiltration. Zero custom malware was deployed. Every action authenticated successfully.

Kerberoasting and DCSync: Active Directory’s Achilles Heel

Two techniques deserve specific attention for enterprise environments running Active Directory:

Kerberoasting allows any authenticated domain user to request service tickets for accounts with Service Principal Names (SPNs). These tickets are encrypted with the service account’s NTLM hash and can be cracked offline. A 2024 SANS Institute study found that in 71% of AD environments tested during red team engagements, at least one Kerberoastable account with domain admin privileges existed.

DCSync abuses Active Directory’s replication protocol, allowing an attacker with appropriate permissions (typically domain admin or specific replication rights) to extract password hashes for every account in the domain — including the KRBTGT account, enabling Golden Ticket attacks that can persist for years if KRBTGT is not regularly rotated.

Cloud and Hybrid Environments: Expanding the Identity Attack Surface

The migration of enterprise workloads to cloud platforms has not reduced identity-based lateral movement risk — it has multiplied the attack surface across dimensions that traditional Active Directory defenses simply cannot cover.

In AWS environments, adversaries abuse IAM role chaining, where a compromised EC2 instance’s instance profile can be used to assume progressively higher-privilege roles. In Azure, Managed Identity tokens can be exfiltrated from the IMDS (Instance Metadata Service) endpoint and replayed to authenticate to Azure Resource Manager APIs. In Google Cloud, service account key files — often committed accidentally to public GitHub repositories — provide direct access to production environments.

The SaaS Identity Sprawl Problem

Enterprise SaaS adoption has created an identity sprawl problem that compounds lateral movement risk significantly. The average enterprise now manages identities across 254 SaaS applications (Okta Business at Work, 2026). Many of these applications are connected via OAuth grants made by individual employees — grants that persist long after the employee leaves, the application is decommissioned, or the use case changes.

Adversaries who compromise a single identity can enumerate all connected OAuth applications, identify those with broad permissions, and pivot to corporate data stores, communication platforms, or financial systems without ever touching the core enterprise network. This cloud-to-cloud lateral movement is almost entirely invisible to network-centric monitoring tools.

“The perimeter is now the identity. Every authentication decision is a security control point — and most organizations are still treating them like plumbing rather than policy.” — Jen Easterly, former CISA Director, RSA Conference 2025

Detection Strategies: Finding Signal in Legitimate Noise

The fundamental challenge of detecting identity-based lateral movement is that individual events are authentic. Detection requires behavioral analytics, contextual correlation, and an understanding of what “normal” looks like for every identity in your environment.

Behavioral Baselines and Anomaly Detection

Effective detection programs start with establishing granular behavioral baselines per identity — not per user class. Key behavioral signals to monitor include:

• Authentication time anomalies: A service account that authenticates only during business hours suddenly authenticating at 2:47 AM UTC warrants immediate investigation.
• Impossible travel: Authentication from geographically implausible locations within timeframes that preclude physical travel — a signal that Microsoft Entra ID Conditional Access can flag automatically.
• Lateral authentication patterns: An account authenticating to systems it has never previously accessed, particularly in rapid succession, is a strong indicator of credential abuse.
• Privilege escalation sequences: Requests for elevated tokens or role assumptions that fall outside established operational patterns.
• Ticket anomalies: Kerberos tickets with unusual lifetimes, encryption types inconsistent with your environment’s standards, or SPNs that don’t correspond to registered services.

Microsoft’s Defender for Identity (formerly Azure ATP) demonstrated a 91% detection rate for Pass-the-Hash and Pass-the-Ticket attacks in independent testing conducted by SE Labs in Q1 2026, leveraging precisely this kind of entity behavioral analysis (UEBA).

SIEM Correlation Rules That Actually Work

Raw log collection without effective correlation rules is a data warehouse, not a detection program. Security teams should implement correlation logic specifically tuned for identity chain attacks:

• Alert when the same credential authenticates to more than N unique hosts within a defined time window (recommended threshold: 5 hosts in 15 minutes for non-admin accounts).
• Flag NTLM authentication events from accounts that typically use Kerberos — often indicative of credential relay attacks.
• Correlate AD replication events (EventID 4662) from non-domain controller sources with subsequent privileged authentications.
• Alert on new OAuth application registrations with high-permission scopes, particularly those registered outside business hours or by accounts with no prior application development history.

Mitigation Frameworks: Building Identity-First Defense

Detection without architecture is incomplete. Sustainable defense against identity-based lateral movement requires structural controls that reduce the blast radius of any single credential compromise.

Privileged Access Management and Tiered Administration

Microsoft’s Enterprise Access Model (formerly the AD Tier Model) provides a proven architectural framework for containing identity-based lateral movement. The model enforces strict segmentation: administrative credentials used to manage Tier 0 assets (domain controllers, identity infrastructure) must never be used on Tier 1 (server workloads) or Tier 2 (user workstations) systems.

Practical implementation priorities include:

• Privileged Access Workstations (PAWs): Dedicated, hardened devices from which privileged operations are performed, preventing credential exposure on general-purpose endpoints.
• Just-In-Time (JIT) access: Eliminating standing privilege by provisioning elevated access only when needed and for defined durations. CyberArk’s 2026 Identity Security Threat Landscape report found organizations using JIT access suffered 67% fewer successful lateral movement incidents.
• LAPS (Local Administrator Password Solution): Randomizing local administrator passwords across endpoints eliminates the “one password, all machines” vulnerability that makes Pass-the-Hash attacks so devastating in flat networks.
• KRBTGT account rotation: Rotating the KRBTGT password (twice, in sequence) invalidates all existing Kerberos tickets and eliminates Golden Ticket persistence. This should be a standard post-incident response procedure.

Zero Trust Architecture as a Lateral Movement Countermeasure

Zero Trust principles directly address the trust assumptions that identity-based lateral movement exploits. Key implementation pillars relevant to this threat:

• Verify explicitly: Every authentication request evaluated against device health, user risk score, location, and behavioral context — not just credential validity.
• Least privilege access: Microsegmentation of identity permissions ensures that even a fully compromised account cannot access resources outside its defined operational scope.
• Assume breach: Network segmentation and micro-perimeters limit the ability of an authenticated attacker to move freely, even after a valid authentication event.

NIST SP 800-207 provides the authoritative framework for Zero Trust Architecture implementation, with specific guidance on identity-centric policy enforcement points that directly constrain lateral movement.

Incident Response Considerations for Identity Attacks

When identity-based lateral movement is detected or suspected, standard IR playbooks built around malware containment are inadequate. The incident response approach must be identity-centric from the first moment.

The 2024 MGM Resorts breach — where attackers used vishing to compromise an Okta account and subsequently accessed cloud infrastructure for ten days — illustrated the catastrophic cost of delayed identity-centric response. Estimated losses exceeded $100 million, largely because initial response focused on traditional endpoint containment while the adversary continued to move laterally through cloud identity infrastructure.

Identity-Centric IR Playbook Essentials

1. Scope the identity blast radius immediately: Identify all systems, applications, and cloud resources accessible by the compromised identity and all identities it could have influenced (groups, delegations, OAuth grants).
2. Revoke, don’t reset: Password resets alone are insufficient. Revoke all active sessions, tokens, refresh tokens, and OAuth grants associated with the compromised identity simultaneously.
3. Audit lateral movement timeline: Use authentication logs, Kerberos event logs, and cloud audit trails to reconstruct the full movement chain before attempting remediation — partial remediation is often worse than none.
4. Assess persistence mechanisms: Check for new accounts created, permission modifications, OAuth applications registered, federation trust changes, and conditional access policy modifications made during the compromise window.
5. Rotate adjacent credentials: Any service account or privileged identity that may have been visible to or accessible by the compromised account should be treated as potentially exposed.

Key Takeaways

• Identity is the new perimeter. Lateral movement now operates primarily through legitimate authentication channels, making signature-based and network-centric detection insufficient as standalone controls.
• Service accounts and standing privilege are your highest-risk identities. Over-privileged, under-audited service accounts with non-expiring passwords are the most common entry point for environment-wide compromise via lateral movement.
• Behavioral analytics is not optional. Detection of identity-based lateral movement requires UEBA capabilities that establish per-identity baselines and correlate authentication sequences across systems — not just individual event monitoring.
• Architecture controls reduce blast radius when detection fails. Just-in-time access, LAPS, Privileged Access Workstations, and tiered administration models structurally limit how far any single compromised credential can travel.
• Incident response must be identity-first. Responding to an identity attack with malware-centric playbooks — focusing on endpoint isolation while ignoring token revocation and OAuth grant auditing — leaves adversaries free to continue operating through cloud infrastructure.

Conclusion: Stop Trusting Authentication. Start Verifying Context.

Identity-based lateral movement exploits a fundamental assumption embedded in most enterprise security architectures: that a valid authentication event represents a trustworthy user. That assumption is now the adversary’s most reliable weapon. Closing this gap requires a deliberate shift — from perimeter defense to identity-centric security, from event monitoring to behavioral analysis, from standing privilege to just-in-time access.

The organizations that suffer catastrophic breaches in the coming years will not, in most cases, have failed to patch a vulnerability or deploy an antivirus agent. They will have failed to treat every authenticated identity as a potential threat vector requiring continuous validation.

Start this week with a concrete action: Conduct an inventory of all service accounts in your Active Directory and cloud IAM environments. Identify those with non-expiring passwords, excessive privileges, or SPNs that make them Kerberoastable. Prioritize the top ten highest-privilege service accounts for immediate remediation — rotating credentials, enforcing managed service accounts where possible, and implementing monitoring for anomalous authentication patterns. This single exercise, in our experience working through real-world red team findings, surfaces critical exposure in over 80% of enterprise environments. The attackers already know what they’ll find. It’s time you do too.

{
“title”: “Identity-Based Lateral Movement: Detection & Defense”,